Hewlett-packard Development Company, L.p.

Hewlett Packard Enterprise Development LP

Hewlett-packard Company

Tallac Networks, Inc.

Other

Chuck A Black

Lin A Nease

Robert Lee Faulk, Jr

Paul T Congdon

John M Green

Daniel E Ford

Shaun Wakumoto

Ramachandra Yalakanti

Nathan Stanley Jenne

William R Johnson

Ali Ezzet

Kamat Maruti

Jeffrey A LaBarge

Andrew S Fraley

A protocol such as OpenFlow providing communication between an SDN framework controller on one network and a data plane device for another network can be used to modify or process network packets so that an external application or server can communicate with the controller and obtain information needed to uniquely associate the packets with particular end-stations even after those packets have traversed a NAT router.

Identifying end-stations on private networks

In a method of managing access to a network, a MAC based authentication operation is implemented in determining whether to grant a user device access to the network. In addition, a user is enabled to self-register a user device into a database of authorized users in response to the user being denied access through the MAC based authentication operation and being listed as a valid user in a directory of active network users. Moreover, the directory of active network users is monitored for modification of information pertaining to the users listed in the directory of active network users and the database of authorized users is modified in response to a determination that user information pertaining to at least one user listed in the directory of active network users that affects the database of authorized users has been modified.

Managing access to a network

A probe request from a wireless station can cause the access point to contact a roaming enablement service and alter the services accessible through the access point. The roaming enablement service can identify preferred services of the wireless station and mediate automated negotiations between the access point and a service provider to determine whether the access point may provide a service from the service provider. Upon successful negotiations, the brokerage service can enable the access point to provide access to the preferred services.

Initializing network advertisements from probe requests

In one embodiment, an edge network device may monitor a network service that is provided at a network service device. Information related to the monitored network service may be temporarily stored at the edge network device and transmitted to a remote network device. In one embodiment, an administrative device may compare current extracted information with stored historical information to determine if a unique machine identifier of an end user device has been spoofed.

Determination of spoofing of a unique machine identifier

In some embodiments, in a registration process where a user device is registering for access to a network, a public/private key pair may be generated based on a media access control (MAC) address of a user device. The generated public/private key pair may be transmitted to the user device for future access to the network. In some embodiments, where a user device is requesting access to a network, a MAC address embedded in a public key may be utilized to determine whether access to the network should be granted.

Public key generation utilizing media access control address

Example embodiments disclosed herein relate to authentication based on Media Access Control (MAC) addresses. A network security device receives one or more client identity databases from one or more edge network devices. The client identity databases include MAC addresses of clients and secondary identification information for each of the clients. The network security device determines that a client device has been connected to one of the edge devices. A security action is performed based on whether the MAC address and respective secondary identification information of one of the clients matches the MAC address and respective secondary identification information of the connected client device.

Security actions based on client identity databases

Connection profiles are created and stored. The connection profiles are for connections for sources to connect to a network. The connection profiles identify network attributes and server attributes for the connections and each connection profile includes a status of available or subscribed. A connection profile is assigned to a requested connection for a source. The source is authenticated using a credential, and server attributes from the connection profile are sent to the source to configure the source to use the connection.

Source configuration based on connection profile

Connection profiles are created and stored. The connection profiles are for connections for sources to connect to a network. The connection profiles identify network attributes for the connections and each connection profile includes a status of available or subscribed. A connection profile is assigned to a requested connection for a source. The network attributes for the assigned connection are sent to an edge switch for the source to configure the edge switch to accept traffic for the source.

Network edge switch configuration based on connection profile

Connections for sources to connect to a network are managed by storing connection profiles identifying network attributes for the connections. Each connection profile includes a status of available or subscribed. Requests for connections are received. If a stored connection profile is available that matches the request, the connection for the matching connection profile is assigned to the source.

Managing network connections

Network connection management using connection profiles

A system on a computer network device for managing a network access device capability arranged to alert a computer network administrator if a network access device lacks the capability to implement a user access profile.

Network access device capability alert mechanism

A method and system are described for collecting information from a device in a network at a collection interval. According to an exemplary embodiment, a method for collecting the information includes determining data needed from the device at the collection interval to evaluate the information. A measurement request is defined for collecting the data from the device at the collection interval. The measurement request is merged with other measurement requests for collecting the data from the device at the collection interval into a single merged measurement request at the collection interval. The measurement request is also merged with other measurement requests for collecting the data from the device at different collection intervals having a common integral divisor into a single merged measurement request at a highest of the different collection intervals.

Multi-layered measurement model for data collection and method for data collection using same

A method and system for monitoring a characteristic relating to real-time network health are described. The method includes detecting a functionality attribute of a service application accessed with a server of the network. Networking devices of the network are interrogated in relation to an operational status thereof. The real-time network health characteristic is inferred from the functionality attribute and/or the operational status detected.

Growing community of inventors

Rocklin, CA, United States of America

Chuck A Black